April 11, 2017—KB4015217 (OS Build 14393.1066 and 14393.1083)

Improvements and fixes

This security update includes quality improvements. No new operating system features are being introduced in this update. Key changes include:

Addressed issue that was preventing the Camera application from saving a captured image when "Show recently opened items in Jump Lists on Start or the taskbar" settings is enabled.

Improved the Host Network Service (HNS) to support an overlay network driver for use on Windows Server 2016 to connect containers across hosts using Docker Engine in Swarm Mode.

Addressed issue that was not allowing users to access online help content when clicking the help icon in various Windows applications, such as File Explorer.

Addressed issue where displays turn off unexpectedly even when Turn off display and Screen saver are disabled in the power profile.

Addressed an issue where CredentialGuard-enabled computers joined to Active Directory domains submit two bad logon attempts each time a bad password is provided during a Kerberos-based logon. Logons to Active Directory domains with arbitrarily low account lockout thresholds may be subject to unexpected account lockouts. For example, 2 logons with a bad password could result in an account being locked out if the account lockout threshold is set to 3 or 4.

Addressed issue where some of the VPN drivers do not get migrated when upgrading the OS to Windows 10, version 1607.

Addressed issue that causes virtual machines to fail during high I/O scenarios where the user may log in multiple times.

Addressed issue that was causing connections (after the 1st connection request) from a Remote Desktop Client to a Remote Desktop session to fail after upgrading from Windows 10, version 1511, to Windows 10, version 1607.

Addressed issue that was causing the Command prompt to be not displayed properly through the serial console on headless systems.

Addressed issue that was causing MDM enrollment failtures on devices using Kerberos authentication.

Addressed issue with rendering when a webpage contains a DIV element that has the contenteditable attribute.

Addressed issue that causes text to disappear when you resize an Internet Explorer window when the encoding is Hebrew and any text ends with an underscore character.

Addressed issue that was causing headless machines to not go into S3 sleep mode sometimes.

Enabled warning message in Group Policy Management Console (GPMC) to alert administrators of a design change that may prevent the processing of a User Group after installing security update MS16-072 (KB3163622).

Addressed an issue that was causing Windows Explorer to perform an endless, rapid refresh of a network drive that is mapped to a share, preventing users from performing tasks such as rename object.

Addressed a memory leak in Internet Explorer when hosting a page that contains nested framesets, which load cross-domain content.

Addressed an issue that was causing the print spooler service to hang instead of showing a timeout error when a connection between a bluetooth printer and the machine is lost during printing.

Addressed an issue that was preventing installation of a new printer driver that uses v3 printer drivers.

Improved the reliability of Load Balancing/Failover (LBFO) whenever there is a resource rebalance, a device failure, or a surprise removal of a device.

If you installed earlier updates, only the new fixes contained in this package will be downloaded and installed on your device.

Known issues in this update

This security update introduced an issue in which, if an iSCSI target becomes unavailable, attempts to reconnect will cause a leak. Initiating a new connection to an available target will work as expected. Microsoft is researching this problem and will post more information in this article when the information becomes available. For more information about this issue, see the following section.

User log on failures occur together with a "No Logon Servers Available" error.

Application and service failures occur because of ephemeral port exhaustion.

An unusually high number of ephemeral ports are being used by the System process.

An unusually high number of threads are being used by the System process.

Cause

This issue is caused by a locking issue on Windows Server 2012 R2 and Windows Server 2016 RS1 computers, causing connectivity issues to the iSCSI targets. The issue can occur after installing any of the following updates:

Or, from an administrative CMD prompt, run the following NETSTAT command together with the "Q" switch. This shows "bound" ports that are no longer connected:

NETSTAT –ANOQ

Focus on ports that are owned by the SYSTEM process.

For the three previous points, anything more than 12,000 should be considered suspect. If iSCSI targets are present in the computer, there is high probability that the issue will occur.

Resolution

If the event logs indicate that many reconnections are occurring, work with your iSCSI and network fabric vendor to help diagnose and correct the reason for the failure to maintain connections to iSCSI targets. Make sure that iSCSI targets can be accessed over the current network fabric. Install updated fixes when they become available. This article will be updated with the specific KB article number of the fix to install when it becomes available.

Note We do not recommend that you uninstall any of the March, April, May, or June security rollups. Doing so will expose the computers to known security exploits and other bugs that are mitigated by monthly updates. We recommend that you first work with iSCSI target and network vendors to resolve the connectivity issues that are triggering target reconnects.

How to get this update

This update will be downloaded and installed automatically from Windows Update. To get the stand-alone package for this update, go to the Microsoft Update Catalog website. After this update is installed, the build number will be either 14393.1066 (for all Windows 10 devices except HoloLens) or 14393.1083 (for HoloLens).

File information For a list of the files that are provided in this update, download the file information for cumulative update 4015217. If you're installing a Windows 10 update for the first time, the package size for the X86 version is 572 MB and the package size for the x64 version is 1,094 MB.